VulnerabilityAnalyzed
CVE-2026-102585
A flaw was found in Moodle.
MEDIUM 4.3EPSS 0.20%
Does this matter?
Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.20% probability · 10th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-842
- Affected
- moodle/moodle
- Source
- patrick@puiterwijk.org
EPSS moved from 0.2% on 30 September 2026 to 0.2% on 26 October 2026.
References
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-88538Patch
- https://access.redhat.com/security/cve/CVE-2026-102585Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543639Issue Tracking, Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=482503Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.